Re: sys-apps/pcsc-lite needs to access /sys
Luis Ressel <[email protected]>
| Newsgroups | gmane.linux.gentoo.hardened |
|---|---|
| Message-ID | <[email protected]> |
On Mon, 17 Feb 2014 19:24:51 +0000 Sven Vermeulen <[email protected]> wrote: > The init script approach is what most distributions are doing. We also > relabel cpu/online in the selinux_gentoo init script. > > But the approach you mentioned on the other mailinglist (regarding > reusing the statement already in use for /proc stuff) seems like a > valid case - interesting to see what's going to happen ;) Yes, I'm trying to find better technical solutions than the init script approach, both for cpu_online_t and for the sysfs access. I've just written a kernel patch to make the sysfs gid configurable, let's see if grsecurity will incorporate it... Regards, Luis Ressel
signature.asc
(application/pgp-signature, 966 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQJ8BAEBCgBmBQJTAmQzXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBMjU3MDBFQTc5QkYzMkY4NEQzMTFGNDlD NzE4OTFBNkEwRUZCN0U5AAoJEMcYkaag77fpjkYP/R8A8kdSuJEvWyuWfe+GaviM rdYymws1yn3v3yBlst56Uucer3d/OONsp4nJCYlMgw7z4LbFYTEQLNWT+8x7G70s WXISy+S6DGe3ZA54Snl9e6akLacPUlkHXCRJQy+G6fPU7NKzutJhNG0boVTANZIn N3NaNmGuGBAPfqlhFyT/3W32R3pjivcc+FRnRoJICJxQH3PqoImXmm1tI2DBxpSN 0qrunB66h4GXo5SuWLRSqi3RSLTwGcrbjjLzoirPhO1QgKtM6YvBFGkHm9BAghsA qG5dc1CxlEruQ/IVtj1pzpM3f7JYdknrGa4U0VwHG5/qAUQQaLxNWFY4L0WwaamX c1vqvY+zKb57XVxyImh3PrVvQDMXf6amY8v/cvGnN94pwv85qWiMXAt1Lo/JJGIA Gc4+UWzHWmqwcdPauRRSxF6obzh/6VeusaR+y5ERYtQ0x+DLfQtu/v/m5XonUIrK JKhL9j+ZJ4U+ow3/2vz99dR5YhHplJjOPMu9kllQUdcVMaDl8vtBiYycqyw3yvmi PuxVJUQvNYNhfOPSpw8gEjuecW8rPrJwe8DvbXx72M59SM4bvsEPhfHtjWoRsSPL 2ihXhX0sU4INmF+VxTLRd+8FkedW5jP5RnX7L0NVwZJ4eVI7EhgW0CSp4Jw5stEm bd2AEqgbOaVNMsMrc++K =NUWC -----END PGP SIGNATURE-----